iec-cli 0.6.6

package/dist/templates/api/helm/{{name}}/templates/ingress.yaml

@@ -0,0 +1,43 @@
+{{- if .Values.ingress.enabled -}}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ .Release.Name }}
+  labels:
+    app: {{ .Release.Name }}
+    app.kubernetes.io/name: {{ .Release.Name }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+  {{- with .Values.ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- if .Values.ingress.className }}
+  ingressClassName: {{ .Values.ingress.className }}
+  {{- end }}
+  {{- if .Values.ingress.tls }}
+  tls:
+    {{- range .Values.ingress.tls }}
+    - hosts:
+        {{- range .hosts }}
+        - {{ . | quote }}
+        {{- end }}
+      secretName: {{ .secretName }}
+    {{- end }}
+  {{- end }}
+  rules:
+    {{- range .Values.ingress.hosts }}
+    - host: {{ .host | quote }}
+      http:
+        paths:
+          {{- range .paths }}
+          - path: {{ .path }}
+            pathType: {{ .pathType }}
+            backend:
+              service:
+                name: {{ $.Release.Name }}
+                port:
+                  number: {{ $.Values.service.port }}
+          {{- end }}
+    {{- end }}
+{{- end }}

package/dist/templates/api/helm/{{name}}/templates/service.yaml

@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Release.Name }}
+  labels:
+    app: {{ .Release.Name }}
+    app.kubernetes.io/name: {{ .Release.Name }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+spec:
+  type: {{ .Values.service.type }}
+  ports:
+    - port: {{ .Values.service.port }}
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    app: {{ .Release.Name }}

package/dist/templates/api/helm/{{name}}/values.yaml

@@ -0,0 +1,64 @@
+replicaCount: 1
+
+image:
+  repository: registry.digitalocean.com/insureco/{{name}}
+  tag: latest
+  pullPolicy: IfNotPresent
+
+imagePullSecrets:
+  - name: insureco
+
+service:
+  type: ClusterIP
+  port: 3000
+
+resources:
+  limits:
+    cpu: 500m
+    memory: 512Mi
+  requests:
+    cpu: 100m
+    memory: 128Mi
+
+autoscaling:
+  enabled: false
+  minReplicas: 1
+  maxReplicas: 5
+  targetCPUUtilizationPercentage: 80
+
+nodeSelector: {}
+
+tolerations: []
+
+affinity: {}
+
+env: {}
+# Example:
+#   DATABASE_URL: mongodb://mongodb:27017/{{name}}
+
+secrets: {}
+# Example:
+#   API_KEY: secret-value
+
+ingress:
+  enabled: false
+  className: nginx
+  annotations: {}
+  hosts: []
+  tls: []
+
+secretRef: ""
+
+livenessProbe:
+  httpGet:
+    path: /health
+    port: 3000
+  initialDelaySeconds: 10
+  periodSeconds: 10
+
+readinessProbe:
+  httpGet:
+    path: /health
+    port: 3000
+  initialDelaySeconds: 5
+  periodSeconds: 5

package/dist/templates/api/package.json

@@ -0,0 +1,33 @@
+{
+  "name": "{{name}}",
+  "version": "0.1.0",
+  "description": "{{description}}",
+  "type": "module",
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsx watch src/index.ts",
+    "start": "node dist/index.js",
+    "lint": "eslint src --ext .ts",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest"
+  },
+  "dependencies": {
+    "express": "^4.21.0",
+    "cors": "^2.8.5",
+    "helmet": "^8.0.0",
+    "zod": "^3.24.0"
+  },
+  "devDependencies": {
+    "@types/cors": "^2.8.17",
+    "@types/express": "^5.0.0",
+    "@types/node": "^22.0.0",
+    "eslint": "^9.0.0",
+    "tsx": "^4.0.0",
+    "typescript": "^5.7.0",
+    "vitest": "^2.0.0"
+  },
+  "engines": {
+    "node": ">=20.0.0"
+  }
+}

package/dist/templates/api/src/index.ts

@@ -0,0 +1,61 @@
+import express, { type Request, type Response, type NextFunction } from 'express'
+import cors from 'cors'
+import helmet from 'helmet'
+import { itemsRouter } from './routes/example.js'
+
+const app = express()
+const PORT = process.env.PORT || 3000
+
+// Middleware
+app.use(helmet())
+app.use(cors())
+app.use(express.json())
+
+// Request logging
+app.use((req: Request, _res: Response, next: NextFunction) => {
+  const timestamp = new Date().toISOString()
+  process.stdout.write(`[${timestamp}] ${req.method} ${req.path}\n`)
+  next()
+})
+
+// Health check endpoint
+app.get('/health', (_req: Request, res: Response) => {
+  res.json({
+    status: 'healthy',
+    service: '{{name}}',
+    timestamp: new Date().toISOString(),
+    uptime: process.uptime(),
+  })
+})
+
+// API routes
+app.use('/api/items', itemsRouter)
+
+// 404 handler
+app.use((_req: Request, res: Response) => {
+  res.status(404).json({
+    success: false,
+    error: {
+      code: 'NOT_FOUND',
+      message: 'The requested resource was not found',
+    },
+  })
+})
+
+// Error handler
+app.use((err: Error, _req: Request, res: Response, _next: NextFunction) => {
+  process.stderr.write(`Error: ${err.message}\n`)
+  res.status(500).json({
+    success: false,
+    error: {
+      code: 'INTERNAL_ERROR',
+      message: process.env.NODE_ENV === 'production'
+        ? 'An internal error occurred'
+        : err.message,
+    },
+  })
+})
+
+app.listen(PORT, () => {
+  process.stdout.write(`{{name}} listening on port ${PORT}\n`)
+})

package/dist/templates/api/src/routes/example.ts

@@ -0,0 +1,165 @@
+import { Router, type Request, type Response } from 'express'
+import { z } from 'zod'
+
+const router = Router()
+
+// In-memory storage for demo purposes
+interface Item {
+  id: string
+  name: string
+  description: string
+  createdAt: string
+  updatedAt: string
+}
+
+const items: Map<string, Item> = new Map()
+
+// Validation schemas
+const CreateItemSchema = z.object({
+  name: z.string().min(1).max(100),
+  description: z.string().max(500).optional().default(''),
+})
+
+const UpdateItemSchema = z.object({
+  name: z.string().min(1).max(100).optional(),
+  description: z.string().max(500).optional(),
+})
+
+// Generate unique ID
+function generateId(): string {
+  return Date.now().toString(36) + Math.random().toString(36).substring(2)
+}
+
+// List all items
+router.get('/', (_req: Request, res: Response) => {
+  const itemList = Array.from(items.values())
+  res.json({
+    success: true,
+    data: itemList,
+    meta: {
+      total: itemList.length,
+      timestamp: new Date().toISOString(),
+    },
+  })
+})
+
+// Get single item
+router.get('/:id', (req: Request, res: Response) => {
+  const id = req.params.id as string
+  const item = items.get(id)
+
+  if (!item) {
+    res.status(404).json({
+      success: false,
+      error: {
+        code: 'NOT_FOUND',
+        message: 'Item not found',
+      },
+    })
+    return
+  }
+
+  res.json({
+    success: true,
+    data: item,
+  })
+})
+
+// Create item
+router.post('/', (req: Request, res: Response) => {
+  const result = CreateItemSchema.safeParse(req.body)
+
+  if (!result.success) {
+    res.status(400).json({
+      success: false,
+      error: {
+        code: 'VALIDATION_ERROR',
+        message: 'Invalid request body',
+        details: result.error.flatten(),
+      },
+    })
+    return
+  }
+
+  const now = new Date().toISOString()
+  const item: Item = {
+    id: generateId(),
+    name: result.data.name,
+    description: result.data.description,
+    createdAt: now,
+    updatedAt: now,
+  }
+
+  items.set(item.id, item)
+
+  res.status(201).json({
+    success: true,
+    data: item,
+  })
+})
+
+// Update item
+router.put('/:id', (req: Request, res: Response) => {
+  const id = req.params.id as string
+  const existing = items.get(id)
+
+  if (!existing) {
+    res.status(404).json({
+      success: false,
+      error: {
+        code: 'NOT_FOUND',
+        message: 'Item not found',
+      },
+    })
+    return
+  }
+
+  const result = UpdateItemSchema.safeParse(req.body)
+
+  if (!result.success) {
+    res.status(400).json({
+      success: false,
+      error: {
+        code: 'VALIDATION_ERROR',
+        message: 'Invalid request body',
+        details: result.error.flatten(),
+      },
+    })
+    return
+  }
+
+  const updated: Item = {
+    ...existing,
+    name: result.data.name ?? existing.name,
+    description: result.data.description ?? existing.description,
+    updatedAt: new Date().toISOString(),
+  }
+
+  items.set(updated.id, updated)
+
+  res.json({
+    success: true,
+    data: updated,
+  })
+})
+
+// Delete item
+router.delete('/:id', (req: Request, res: Response) => {
+  const id = req.params.id as string
+  const existed = items.delete(id)
+
+  if (!existed) {
+    res.status(404).json({
+      success: false,
+      error: {
+        code: 'NOT_FOUND',
+        message: 'Item not found',
+      },
+    })
+    return
+  }
+
+  res.status(204).send()
+})
+
+export { router as itemsRouter }

package/dist/templates/api/tsconfig.json

@@ -0,0 +1,18 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "outDir": "./dist",
+    "rootDir": "./src",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "forceConsistentCasingInFileNames": true,
+    "declaration": true,
+    "declarationMap": true,
+    "sourceMap": true
+  },
+  "include": ["src/**/*"],
+  "exclude": ["node_modules", "dist"]
+}

package/dist/templates/crosspod/README.md

@@ -0,0 +1,87 @@
+# {{name}} - Pod-to-Pod Communication Demo
+
+This template demonstrates service-to-service (pod-to-pod) communication within the Tawa platform.
+
+## Architecture
+
+```
+                    ┌─────────────────┐
+                    │     Client      │
+                    └────────┬────────┘
+                             │
+                    ┌────────▼────────┐
+                    │    Janus API    │
+                    │     Gateway     │
+                    └────────┬────────┘
+                             │
+         ┌───────────────────┼───────────────────┐
+         │                   │                   │
+┌────────▼────────┐ ┌────────▼────────┐         │
+│   service-a     │ │   service-b     │         │
+│   (Provider)    │ │   (Consumer)    │         │
+│                 │ │                 │         │
+│ Exposes data    │ │ Calls service-a │         │
+│ via REST API    │ │ internally      │         │
+└─────────────────┘ └────────┬────────┘         │
+                             │                   │
+                    ┌────────▼────────┐         │
+                    │   Internal K8s  │◄────────┘
+                    │   Service DNS   │
+                    └─────────────────┘
+```
+
+## Services
+
+### service-a (Provider)
+
+- Exposes data via REST API
+- Routes configured with `auth: service` for internal-only access
+- Accessible at `http://{{name}}-service-a:3000` within the cluster
+
+### service-b (Consumer)
+
+- Calls service-a to retrieve and process data
+- Uses internal Kubernetes DNS for service discovery
+- Demonstrates service-to-service authentication
+
+## Pod-to-Pod Authentication
+
+When `auth: service` is set on a route in `catalog-info.yaml`:
+
+1. Requests must include service credentials
+2. Janus validates the calling service identity
+3. Only registered services can access protected endpoints
+
+### Example catalog-info.yaml configuration:
+
+```yaml
+spec:
+  routes:
+    - path: /api/internal/*
+      methods: [GET, POST]
+      auth: service  # Only other services can call this
+      scopes:
+        - read:data
+```
+
+## Deployment
+
+Deploy both services:
+
+```bash
+cd {{name}}/service-a
+iec link && iec deploy
+
+cd ../service-b
+iec link && iec deploy
+```
+
+## Testing
+
+1. Deploy both services to sandbox
+2. Call service-b's `/api/data` endpoint
+3. service-b will internally call service-a and return combined data
+
+```bash
+curl https://{{name}}-service-b.sandbox.tawa.insureco.io/api/data
+```

package/dist/templates/crosspod/service-a/Dockerfile

@@ -0,0 +1,27 @@
+FROM node:22-alpine AS builder
+WORKDIR /app
+COPY package*.json ./
+RUN npm ci
+COPY . .
+RUN npm run build
+
+FROM node:22-alpine
+WORKDIR /app
+COPY package*.json ./
+RUN npm ci --production && npm cache clean --force
+COPY --from=builder /app/dist ./dist
+
+ENV NODE_ENV=production
+ENV PORT=3000
+
+RUN addgroup -g 1001 -S nodejs && \
+    adduser -S nodejs -u 1001 && \
+    chown -R nodejs:nodejs /app
+
+USER nodejs
+EXPOSE 3000
+
+HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
+  CMD wget --no-verbose --tries=1 --spider http://localhost:3000/health || exit 1
+
+CMD ["node", "dist/index.js"]

package/dist/templates/crosspod/service-a/catalog-info.yaml

@@ -0,0 +1,54 @@
+apiVersion: backstage.io/v1alpha1
+kind: Component
+metadata:
+  name: {{name}}-service-a
+  description: Provider service for {{name}} - exposes internal data API
+  tags:
+    - tawa
+    - api
+    - provider
+  annotations:
+    insureco.io/framework: express
+    insureco.io/language: typescript
+spec:
+  type: service
+  lifecycle: experimental
+  owner: {{owner}}
+  providesApis:
+    - {{name}}-service-a-api
+  routes:
+    - path: /health
+      methods: [GET]
+      auth: none
+      description: Health check endpoint
+    - path: /api/internal/*
+      methods: [GET, POST]
+      auth: service
+      scopes:
+        - read:data
+        - write:data
+      description: Internal API - service-to-service only
+---
+apiVersion: backstage.io/v1alpha1
+kind: API
+metadata:
+  name: {{name}}-service-a-api
+  description: Internal data API for {{name}}
+spec:
+  type: openapi
+  lifecycle: experimental
+  owner: {{owner}}
+  definition: |
+    openapi: 3.0.0
+    info:
+      title: {{name}} Service A API
+      version: 1.0.0
+    paths:
+      /api/internal/items:
+        get:
+          summary: Get all items (service-to-service only)
+          security:
+            - serviceAuth: []
+          responses:
+            '200':
+              description: List of items

package/dist/templates/crosspod/service-a/gitignore

@@ -0,0 +1,5 @@
+node_modules/
+dist/
+.env
+.env.local
+*.log

package/dist/templates/crosspod/service-a/helm/{{name}}-service-a/Chart.yaml

@@ -0,0 +1,6 @@
+apiVersion: v2
+name: {{name}}-service-a
+description: Provider service Helm chart
+type: application
+version: 0.1.0
+appVersion: "0.1.0"

package/dist/templates/crosspod/service-a/helm/{{name}}-service-a/templates/deployment.yaml

@@ -0,0 +1,72 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Release.Name }}
+  labels:
+    app: {{ .Release.Name }}
+    app.kubernetes.io/name: {{ .Release.Name }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+spec:
+  replicas: {{ .Values.replicaCount }}
+  selector:
+    matchLabels:
+      app: {{ .Release.Name }}
+  template:
+    metadata:
+      labels:
+        app: {{ .Release.Name }}
+        app.kubernetes.io/name: {{ .Release.Name }}
+        app.kubernetes.io/instance: {{ .Release.Name }}
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+        - name: {{ .Chart.Name }}
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          ports:
+            - name: http
+              containerPort: {{ .Values.service.port }}
+              protocol: TCP
+          envFrom:
+            - configMapRef:
+                name: {{ .Release.Name }}-config
+                optional: true
+            - secretRef:
+                name: {{ .Release.Name }}-secrets
+                optional: true
+            {{- if .Values.secretRef }}
+            - secretRef:
+                name: {{ .Values.secretRef }}
+            {{- end }}
+          {{- with .Values.env }}
+          env:
+            {{- range $key, $value := . }}
+            - name: {{ $key }}
+              value: {{ $value | quote }}
+            {{- end }}
+          {{- end }}
+          {{- with .Values.livenessProbe }}
+          livenessProbe:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.readinessProbe }}
+          readinessProbe:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}

package/dist/templates/crosspod/service-a/helm/{{name}}-service-a/templates/ingress.yaml

@@ -0,0 +1,43 @@
+{{- if .Values.ingress.enabled -}}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ .Release.Name }}
+  labels:
+    app: {{ .Release.Name }}
+    app.kubernetes.io/name: {{ .Release.Name }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+  {{- with .Values.ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- if .Values.ingress.className }}
+  ingressClassName: {{ .Values.ingress.className }}
+  {{- end }}
+  {{- if .Values.ingress.tls }}
+  tls:
+    {{- range .Values.ingress.tls }}
+    - hosts:
+        {{- range .hosts }}
+        - {{ . | quote }}
+        {{- end }}
+      secretName: {{ .secretName }}
+    {{- end }}
+  {{- end }}
+  rules:
+    {{- range .Values.ingress.hosts }}
+    - host: {{ .host | quote }}
+      http:
+        paths:
+          {{- range .paths }}
+          - path: {{ .path }}
+            pathType: {{ .pathType }}
+            backend:
+              service:
+                name: {{ $.Release.Name }}
+                port:
+                  number: {{ $.Values.service.port }}
+          {{- end }}
+    {{- end }}
+{{- end }}